@pnpm/installing.deps-resolver 1100.2.7 → 1100.2.8

package/lib/hoistPeers.d.ts

@@ -1,9 +1,14 @@
 import type { PreferredVersions } from '@pnpm/resolving.resolver-base';
-import type { PkgAddressOrLink } from './resolveDependencies.js';
+/** One workspace-root dependency that a missing peer can be satisfied with. */
+export interface HoistableRootDep {
+    alias: string;
+    pkgName: string;
+    normalizedBareSpecifier?: string;
+}
 export declare function hoistPeers(opts: {
     autoInstallPeers: boolean;
     allPreferredVersions?: PreferredVersions;
-    workspaceRootDeps: PkgAddressOrLink[];
+    workspaceRootDeps: HoistableRootDep[];
 }, missingRequiredPeers: Array<[string, {
     range: string;
 }]>): Record<string, string>;

package/lib/hoistPeers.js

@@ -9,7 +9,7 @@ export function hoistPeers(opts, missingRequiredPeers) {
             continue;
         }
         const rootDep = opts.workspaceRootDeps
-            .filter((rootDep) => rootDep.pkg.name === peerName)
+            .filter((rootDep) => rootDep.pkgName === peerName)
             .sort((rootDep1, rootDep2) => lexCompare(rootDep1.alias, rootDep2.alias))[0];
         if (rootDep?.normalizedBareSpecifier) {
             dependencies[peerName] = rootDep.normalizedBareSpecifier;
@@ -27,22 +27,28 @@ export function hoistPeers(opts, missingRequiredPeers) {
                     nonVersions.push(spec);
                 }
             }
-            // When the range is an exact version (e.g. pinned by an override like "4.3.0"),
-            // try to find a preferred version that satisfies it. This prevents a stale
-            // higher version from the lockfile being picked over the overridden version.
-            // For regular semver ranges (e.g. "^1.0.0"), use the highest preferred
-            // version for deduplication.
-            const isExactVersion = semver.valid(range) != null;
-            const satisfyingVersion = isExactVersion
+            // Dedupe onto a preferred version only when it actually satisfies the
+            // wanted peer range. Picking the highest preferred version regardless of
+            // the range lets a version resolved for one importer be auto-installed as
+            // another importer's peer even though nothing in that importer's closure
+            // accepts it, silently producing a peer graph that mixes incompatible
+            // majors. Ranges that are not semver (workspace:, npm: aliases, dist-tags)
+            // cannot be checked, so they keep the dedupe-to-highest behavior.
+            const isSemverRange = semver.validRange(range, { includePrerelease: true }) != null;
+            const satisfyingVersion = isSemverRange
                 ? semver.maxSatisfying(versions, range, { includePrerelease: true })
                 : null;
             if (satisfyingVersion) {
                 dependencies[peerName] = [satisfyingVersion, ...nonVersions].join(' || ');
             }
-            else if (isExactVersion && opts.autoInstallPeers) {
-                // No preferred version satisfies the exact override version.
-                // Use the range directly so pnpm resolves it from the registry.
-                dependencies[peerName] = range;
+            else if (isSemverRange && versions.length > 0) {
+                // Preferred versions exist but none satisfies the wanted range.
+                // Use the range directly so pnpm resolves it from the registry rather
+                // than installing a version the peer explicitly rejects. Without
+                // autoInstallPeers, hoist nothing and leave the peer missing.
+                if (opts.autoInstallPeers) {
+                    dependencies[peerName] = range;
+                }
             }
             else {
                 dependencies[peerName] = [semver.maxSatisfying(versions, '*', { includePrerelease: true }), ...nonVersions]

package/lib/resolveDependencies.js

@@ -54,7 +54,7 @@ export async function resolveRootDependencies(ctx, importers) {
     let workspaceRootDeps;
     if (ctx.resolvePeersFromWorkspaceRoot) {
         const rootImporterIndex = importers.findIndex(({ options }) => options.parentIds[0] === '.');
-        workspaceRootDeps = pkgAddressesByImportersWithoutPeers[rootImporterIndex]?.pkgAddresses ?? [];
+        workspaceRootDeps = getHoistableRootDeps(importers[rootImporterIndex], pkgAddressesByImportersWithoutPeers[rootImporterIndex]?.pkgAddresses ?? []);
     }
     else {
         workspaceRootDeps = [];
@@ -150,6 +150,38 @@ export async function resolveRootDependencies(ctx, importers) {
         time,
     };
 }
+/**
+ * Lists the workspace-root dependencies that `hoistPeers` may satisfy a
+ * missing peer with. A root dependency reused from the lockfile skips full
+ * resolution, so it has no address (or an address without a
+ * normalizedBareSpecifier); its wanted specifier is used instead, so that
+ * re-resolving with a lockfile hoists the same version as a fresh install of
+ * the same manifest.
+ */
+function getHoistableRootDeps(rootImporter, rootPkgAddresses) {
+    const wantedSpecifierByAlias = new Map();
+    for (const wantedDep of rootImporter?.wantedDependencies ?? []) {
+        if (wantedDep.alias && wantedDep.bareSpecifier) {
+            wantedSpecifierByAlias.set(wantedDep.alias, wantedDep.bareSpecifier);
+        }
+    }
+    const rootDeps = rootPkgAddresses.map((pkgAddress) => ({
+        alias: pkgAddress.alias,
+        pkgName: pkgAddress.pkg.name,
+        normalizedBareSpecifier: pkgAddress.normalizedBareSpecifier ?? wantedSpecifierByAlias.get(pkgAddress.alias),
+    }));
+    const coveredAliases = new Set(rootDeps.map(({ alias }) => alias));
+    for (const [alias, bareSpecifier] of wantedSpecifierByAlias) {
+        if (coveredAliases.has(alias))
+            continue;
+        rootDeps.push({
+            alias,
+            pkgName: unwrapPackageName(alias, bareSpecifier).pkgName,
+            normalizedBareSpecifier: bareSpecifier,
+        });
+    }
+    return rootDeps;
+}
 async function resolveDependenciesOfImporters(ctx, importers) {
     const pickLowestVersion = ctx.resolutionMode === 'time-based' || ctx.resolutionMode === 'lowest-direct';
     const resolveResults = await Promise.all(importers.map(async (importer) => {

package/lib/resolvePeers.js

@@ -13,6 +13,9 @@ export async function resolvePeers(opts) {
     const depGraph = {};
     const pathsByNodeId = new Map();
     const pathsByNodeIdPromises = new Map();
+    const awaitedPeerNodeIdsByNodeId = new Map();
+    const peersCacheOwnerByNodeId = new Map();
+    const cycleBrokenNodeIds = new Set();
     const depPathsByPkgId = new Map();
     const nodeIdsByPreviousDepPath = opts.resolvedPeerProviderPaths == null
         ? new Map()
@@ -76,6 +79,9 @@ export async function resolvePeers(opts) {
             parentDepPathsChain: [],
             pathsByNodeId,
             pathsByNodeIdPromises,
+            awaitedPeerNodeIdsByNodeId,
+            peersCacheOwnerByNodeId,
+            cycleBrokenNodeIds,
             depPathsByPkgId,
             nodeIdsByPreviousDepPath,
             resolvedPeerProviderPaths: opts.resolvedPeerProviderPaths,
@@ -102,6 +108,9 @@ export async function resolvePeers(opts) {
         // its cycle analysis only sees the children of one call, and providers
         // frequently peer-depend on each other, so resolving them one by one
         // would leave their dep path calculations awaiting each other forever.
+        // A peer cycle that spans this call and the traversal above is still
+        // invisible here; breakDepPathAwaitCycles resolves those before the
+        // finishing promises are awaited.
         const prunedProviderChildren = {};
         for (const [alias, nodeId] of Object.entries(hoistedProviderChildren)) {
             if (parentPkgsOfNode.has(nodeId))
@@ -122,6 +131,14 @@ export async function resolvePeers(opts) {
             };
         }
     }
+    breakDepPathAwaitCycles({
+        awaitedPeerNodeIdsByNodeId,
+        peersCacheOwnerByNodeId,
+        cycleBrokenNodeIds,
+        pathsByNodeId,
+        pathsByNodeIdPromises,
+        dependenciesTree: opts.dependenciesTree,
+    });
     await Promise.all(finishingList);
     const depGraphWithResolvedChildren = resolveChildren(depGraph);
     function resolveChildren(depGraph) {
@@ -168,6 +185,62 @@ export async function resolvePeers(opts) {
         pathsByNodeId,
     };
 }
+// Cycle analysis inside resolvePeersOfChildren only sees the children of a
+// single call, but a dep path calculation may await a node resolved in a
+// different call or at a different tree level (a hoisted peer provider and
+// a consumer that peer-depend on each other, https://github.com/pnpm/pnpm/issues/12921).
+// Such an await cycle never settles on its own, so before the finishing
+// promises are awaited, walk the recorded await edges and resolve every
+// dep path promise on a cycle to the peer's `name@version` — the same
+// collapse in-call cycle detection applies (see calculateDepPath).
+// A node that hit the peers cache awaits its dep path from the node that
+// created the cache entry, so it borrows that owner's await edges.
+function breakDepPathAwaitCycles(opts) {
+    const isSettled = (nodeId) => opts.pathsByNodeId.has(nodeId) || opts.cycleBrokenNodeIds.has(nodeId);
+    const keysByNodeId = new Map();
+    const nodeIdsByKey = new Map();
+    function keyOf(nodeId) {
+        let key = keysByNodeId.get(nodeId);
+        if (key == null) {
+            key = String(keysByNodeId.size);
+            keysByNodeId.set(nodeId, key);
+            nodeIdsByKey.set(key, nodeId);
+        }
+        return key;
+    }
+    const graphEntries = [];
+    const awaitingNodeIds = new Set([
+        ...opts.awaitedPeerNodeIdsByNodeId.keys(),
+        ...opts.peersCacheOwnerByNodeId.keys(),
+    ]);
+    for (const nodeId of awaitingNodeIds) {
+        if (isSettled(nodeId))
+            continue;
+        const cacheOwnerNodeId = opts.peersCacheOwnerByNodeId.get(nodeId);
+        const awaitedNodeIds = opts.awaitedPeerNodeIdsByNodeId.get(nodeId) ??
+            (cacheOwnerNodeId == null ? undefined : opts.awaitedPeerNodeIdsByNodeId.get(cacheOwnerNodeId));
+        if (awaitedNodeIds == null)
+            continue;
+        const liveTargets = [];
+        for (const awaitedNodeId of awaitedNodeIds) {
+            if (!isSettled(awaitedNodeId)) {
+                liveTargets.push(keyOf(awaitedNodeId));
+            }
+        }
+        if (liveTargets.length > 0) {
+            graphEntries.push([keyOf(nodeId), liveTargets]);
+        }
+    }
+    if (graphEntries.length === 0)
+        return;
+    const { cycles } = analyzeGraph(graphEntries);
+    for (const key of new Set(cycles.flat())) {
+        const nodeId = nodeIdsByKey.get(key);
+        const { name, version } = opts.dependenciesTree.get(nodeId).resolvedPackage;
+        opts.cycleBrokenNodeIds.add(nodeId);
+        opts.pathsByNodeIdPromises.get(nodeId)?.resolve(`${name}@${version}`);
+    }
+}
 function nodeDepsCount(node) {
     return Object.keys(node.children).length + node.resolvedPeerNames.size;
 }
@@ -389,6 +462,7 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
                 wantedRange,
             });
         }
+        ctx.peersCacheOwnerByNodeId.set(nodeId, hit.ownerNodeId);
         return {
             missingPeers: hit.missingPeers,
             finishing: (async () => {
@@ -451,6 +525,7 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
             missingPeers: allMissingPeers,
             depPath: pDefer(),
             resolvedPeers: allResolvedPeers,
+            ownerNodeId: nodeId,
         };
         if (ctx.peersCache.has(resolvedPackage.pkgIdWithPatchHash)) {
             ctx.peersCache.get(resolvedPackage.pkgIdWithPatchHash).push(cache);
@@ -512,6 +587,7 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
                 if (cyclicPeerAliases.has(pendingPeer.alias)) {
                     const { name, version } = ctx.dependenciesTree.get(pendingPeer.nodeId)?.resolvedPackage;
                     const id = `${name}@${version}`;
+                    ctx.cycleBrokenNodeIds.add(pendingPeer.nodeId);
                     ctx.pathsByNodeIdPromises.get(pendingPeer.nodeId)?.resolve(id);
                     return id;
                 }
@@ -521,6 +597,12 @@ async function resolvePeersOfNode(currentAlias, nodeId, parentParentPkgs, ctx) {
                         return { name: peerNode.resolvedPackage.name, version: peerNode.resolvedPackage.version };
                     }
                 }
+                let awaitedPeerNodeIds = ctx.awaitedPeerNodeIdsByNodeId.get(nodeId);
+                if (awaitedPeerNodeIds == null) {
+                    awaitedPeerNodeIds = new Set();
+                    ctx.awaitedPeerNodeIdsByNodeId.set(nodeId, awaitedPeerNodeIds);
+                }
+                awaitedPeerNodeIds.add(pendingPeer.nodeId);
                 return ctx.pathsByNodeIdPromises.get(pendingPeer.nodeId).promise;
             })),
         ], ctx.peersSuffixMaxLength);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/installing.deps-resolver",
-  "version": "1100.2.7",
+  "version": "1100.2.8",
   "description": "Resolves dependency graph of a package",
   "keywords": [
     "pnpm",
@@ -27,38 +27,23 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/util.lex-comparator": "^4.0.1",
-    "@yarnpkg/core": "4.8.0",
-    "graph-cycles": "3.0.0",
-    "is-inner-link": "^5.0.0",
-    "is-subdir": "^2.0.0",
-    "normalize-path": "^3.0.0",
-    "p-defer": "^4.0.1",
-    "path-exists": "^5.0.0",
-    "promise-share": "^2.0.1",
-    "ramda": "npm:@pnpm/ramda@0.28.1",
-    "rename-overwrite": "^7.0.1",
-    "safe-promise-defer": "^2.0.0",
-    "semver": "^7.8.4",
-    "semver-range-intersect": "^0.3.1",
-    "validate-npm-package-name": "7.0.2",
-    "version-selector-type": "^3.0.0",
     "@pnpm/catalogs.resolver": "1100.0.0",
-    "@pnpm/config.version-policy": "1100.1.6",
     "@pnpm/catalogs.types": "1100.0.0",
+    "@pnpm/config.version-policy": "1100.1.6",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.graph-hasher": "1100.2.8",
     "@pnpm/core-loggers": "1100.2.1",
-    "@pnpm/deps.peer-range": "1100.0.2",
+    "@pnpm/deps.graph-hasher": "1100.2.9",
     "@pnpm/deps.path": "1100.0.8",
+    "@pnpm/deps.peer-range": "1100.0.2",
     "@pnpm/error": "1100.0.1",
-    "@pnpm/fetching.pick-fetcher": "1100.0.14",
-    "@pnpm/hooks.types": "1100.1.1",
-    "@pnpm/lockfile.preferred-versions": "1100.0.18",
-    "@pnpm/lockfile.pruner": "1100.0.13",
+    "@pnpm/fetching.pick-fetcher": "1100.1.0",
     "@pnpm/fs.symlink-dependency": "1100.0.10",
+    "@pnpm/hooks.types": "1100.2.0",
+    "@pnpm/lockfile.preferred-versions": "1100.0.19",
+    "@pnpm/lockfile.pruner": "1100.0.13",
     "@pnpm/lockfile.types": "1100.0.13",
-    "@pnpm/lockfile.utils": "1100.1.1",
+    "@pnpm/lockfile.utils": "1100.1.2",
+    "@pnpm/patching.config": "1100.0.9",
     "@pnpm/patching.types": "1100.0.0",
     "@pnpm/pkg-manifest.reader": "1100.0.9",
     "@pnpm/pkg-manifest.utils": "1100.2.6",
@@ -66,20 +51,35 @@
     "@pnpm/resolving.resolver-base": "1100.5.1",
     "@pnpm/store.controller-types": "1100.1.7",
     "@pnpm/types": "1101.3.2",
-    "@pnpm/patching.config": "1100.0.9",
-    "@pnpm/workspace.spec-parser": "1100.0.0"
+    "@pnpm/util.lex-comparator": "^4.0.1",
+    "@pnpm/workspace.spec-parser": "1100.0.0",
+    "@yarnpkg/core": "4.8.0",
+    "graph-cycles": "3.0.0",
+    "is-inner-link": "^5.0.0",
+    "is-subdir": "^2.0.0",
+    "normalize-path": "^3.0.0",
+    "p-defer": "^4.0.1",
+    "path-exists": "^5.0.0",
+    "promise-share": "^2.0.1",
+    "ramda": "npm:@pnpm/ramda@0.28.1",
+    "rename-overwrite": "^7.0.1",
+    "safe-promise-defer": "^2.0.0",
+    "semver": "^7.8.4",
+    "semver-range-intersect": "^0.3.1",
+    "validate-npm-package-name": "7.0.2",
+    "version-selector-type": "^3.0.0"
   },
   "peerDependencies": {
     "@pnpm/logger": "^1100.0.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
+    "@pnpm/installing.deps-resolver": "1100.2.8",
+    "@pnpm/logger": "1100.0.0",
     "@types/normalize-path": "^3.0.2",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
-    "@types/validate-npm-package-name": "^4.0.2",
-    "@pnpm/installing.deps-resolver": "1100.2.7",
-    "@pnpm/logger": "1100.0.0"
+    "@types/validate-npm-package-name": "^4.0.2"
   },
   "engines": {
     "node": ">=22.13"